EMZETT.Kerberos: Signing in with tickets
In short: A sign-in method in which you identify yourself once to the server for tickets and afterwards access services without entering your password again.
In more detail: Kerberos is an authentication protocol used in Windows domains (Active Directory) and many Unix environments. The password is never sent over the network. Instead, a trusted third party, the key distribution center (KDC), issues time-limited tickets.
In Depth
The parties
- Client: your computer, or you as the user.
- KDC with two parts: the authentication server (AS) and the ticket granting server (TGS).
- Service: for example a file server or a database. All keys are derived from passwords or are held as secrets at the KDC and at the service.
The process in three steps
- Sign-in (AS): the client identifies itself to the AS and receives a ticket granting ticket (TGT), encrypted with a KDC key.
- Service ticket (TGS): with the TGT the client asks the TGS for a ticket for a particular service.
- Access: the client presents the service ticket to the service. The service can decrypt it because only it and the KDC know the matching key. The password is only needed at the start. After that the tickets suffice, which enables single sign-on.
Time and protection
Tickets usually last about ten hours. Attached timestamps (“authenticator”) prevent intercepted tickets from being reused later. That is why the clocks of all parties may differ only by a few minutes, otherwise sign-in fails. Names are mapped through SPNs (service principal names), and DNS must be correct.
Typical attacks
Pass-the-ticket and golden ticket use stolen or forged tickets. Kerberoasting requests service tickets for accounts with an SPN and tries to guess the password offline if it is weak. Countermeasures: long, random passwords for service accounts, monitoring of unusual ticket requests and regularly changing secret keys.
See also: Authentication, Single sign-on, LDAP